CVE-2023-47125
By-passing Cross-Site Scripting Protection in HTML Sanitizer
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
By-passing Cross-Site Scripting Protection in HTML Sanitizer
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2023-47125- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-3000
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
EUVD-2023-3000- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mm79-jhqm-9j54
Bypassing Cross-Site Scripting Protection in TYPO3 HTML Sanitizer
CVSS:
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C(4.4)
Problem
DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer.
Solution
Update to typo3/html-sanitizer versions 1.5.3 or 2.1.4 that fix the problem described.
Credits
Thanks to Yaniv Nizry and Niels Dossche who reported this issue, and to TYPO3 core & security team member Oliver Hader who fixed the issue.
References
- Record
GHSA-mm79-jhqm-9j54- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2023-47125- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
By-passing Cross-Site Scripting Protection in HTML Sanitizer
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2023-47125- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-mm79-jhqm-9j54
Bypassing Cross-Site Scripting Protection in TYPO3 HTML Sanitizer
CVSS:
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C(4.4)
Problem
DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer.
Solution
Update to typo3/html-sanitizer versions 1.5.3 or 2.1.4 that fix the problem described.
Credits
Thanks to Yaniv Nizry and Niels Dossche who reported this issue, and to TYPO3 core & security team member Oliver Hader who fixed the issue.
References
- Record
GHSA-mm79-jhqm-9j54- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVBIT-typo3-2023-47125 No score
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
BIT-typo3-2023-47125- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/html-sanitizerPackagist |
1.0.0 to 1.5.2 | 1.5.3 |
typo3/html-sanitizerPackagist |
2.0.0 to 2.1.3 | 2.1.4 |
typo3Bitnami |
8.7.42 up to 8.7.55, 9.5.29 up to 9.5.44, 10.4.19 up to 10.4.41, 11.3.2 up to 11.5.33, 12.0.0 up to 12.4.8 | 8.7.559.5.4410.4.4111.5.3312.4.8 |
typo3/html-sanitizerPackagist |
1.0.0 up to 1.5.3, plus listed versions v1.0.0v1.0.1v1.0.2v1.0.3v1.0.4 Show 6 moreShow lessv1.0.5v1.0.6v1.0.7v1.5.0v1.5.1v1.5.2 |
1.5.3 |
typo3/html-sanitizerPackagist |
2.0.0 up to 2.1.4, plus listed versions v2.0.0v2.0.1v2.0.10v2.0.11v2.0.12 Show 16 moreShow lessv2.0.13v2.0.14v2.0.15v2.0.16v2.0.2v2.0.3v2.0.4v2.0.5v2.0.6v2.0.7v2.0.8v2.0.9v2.1.0v2.1.1v2.1.2v2.1.3 |
2.1.4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | nikn0laty/TYPO3-HTML-Sanitizer-XSS-CVE-2023-47125 | 2026-01-23 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-47125 is a medium vulnerability (CVSS 4.7) in Typo3 Html-sanitizer, published November 14, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.58%, the 47th percentile. Fixed in typo3/html-sanitizer 1.5.3.
References
github.com/TYPO3/html-sanitizer/security/advisories/GHSA-mm79-jhqm-9j54
typo3.org/security/advisory/typo3-core-sa-2023-007
nvd.nist.gov/vuln/detail/CVE-2023-47125